4 ms·
Since the whole point of notarization is to give Apple the power to revoke malicious binaries on its system after-the-fact, this seems like it works by design,
by jibcage 6y ago
Since the whole point of notarization is to give Apple the power to revoke malicious binaries on its system after-the-fact, this seems like it works by design, no? Apple quickly revoked the notarization once they were alerted of the malware.
Otherwise Apple would have to scan every single binary submitted for notarization, which then puts a pretty large onus on them should anything slip through.
- Karliss 6y agoIf Apple didn't want scan every binary submitted for notarization then they didn't need to introduce the notarization. They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate. The main difference with notarization is that it forces binaries to be submitted to Apple early for inspection in comparison with signing using developer certificate which happens locally.
- natcombs 6y agoWouldn’t you also want the ability to revoke just certain binaries? Let’s say a large company like Microsoft accidentally somehow got malware on their Excel app, you wouldn’t want to terminate the dev cert because that would also cancel Outlook, Word, PowerPoint, etc
- flohofwoe 6y agoIf I'm not mistaken you can create as many code signing certificates as you want, so it makes sense to sign each application with its own certificate. Of course this wouldn't help when Apple "kills" the entire developer account I guess.
- judge2020 6y agoNope, you can only generate 5 Developer ID Application certificates for the lifetime of your Developer account. It's a real pain to get another one, I had lost all of mine (didn't have a real Mac, so was using various temporary Hackintosh and KVM installs) and it took 2 months of emails to both Developer support and the Security team to get another one issued [and backed up].
- EricE 6y agoIt took you five times before you learned to make backups? Woah.
- captainredbeard 6y agoThat's a bit condescending. The signing stack is very complicated and folks often make mistakes when attempting to back up (export) the correct private key and certificate pair.
- judge2020 6y agoI admit it was foolish, but this was over 3 years and I didn't know there was a limit on the number of certificates you could generate.
- 0x0 6y agoThat's what XProtect is for
- grishka 6y agoMoreover, they've had the ability to "revoke binaries" before notarization was a thing. There's a small antivirus scanner that runs on every app you download and on every dmg you mount, and shows a very scary warning if it detects known malware.
- captainredbeard 6y ago> They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate That's a big hammer because it breaks everything that was ever signed with the certificate.
- mullingitover 6y agoThat's fine with me - if the developer was caught with one malware-infected app, I would worry about the other malware they shipped that wasn't caught.
- _qulr 6y agoNot true. They can make the certificate invalid after a certain date, while still allowing software signed before that date. This happened when Panic lost their signing certificate.
- nicky0 6y agoApple actually does claim to scan every submitted binary for "malicious content", among other things.[1] 1: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...